F 5 APPLICATION READY NETWORK GUIDE
CITRIX PRESENTATION SERVER
Increase Availability and Secure Access of Enterprise Applications Using Citrix Presentation Server with F5’s BIG-IP and FirePass Solutions
Executive Summary
Citrix and F5 Networks allow enterprises to take full advantage of their network deployments by providing a solution that enhances scalability and availability of applications on the network. This solution reduces configuration complexity, and is easy to manage, reducing the total cost of ownership. F5 Networks’ BIG-IP® product, an application delivery networking device, adds significant value to a Citrix® Presentation Server® (formerly MetaFrame®) Web interface extension implementation. When deployed together, the BIG-IP product provides organizations the solution they need to deploy mission-critical enterprise applications in a highly available and scalable configuration. The F5 FirePass SSL VPN extends secure access to this highly available, optimally performing network to remote users. With the FirePass controller, employees or partners can access resources from any device in any location as easily and securely as from within the corporate LAN. The FirePass provides secure Web-based access to Citrix Presentation Server devices and supports automatic downloading and installation of the correct Terminal Services remote-platform client component, if it is not currently installed on the remote device.
Challenges
Providing high availability, increased uptime and scalability for servers and applications is critical for both large and small companies. Since Citrix Presentation Server deployments offer a centralized computing platform, enterprises need to ensure reliable access to these critical systems. For sites with remote users, that maintain just one ISP connection they are challenged with a point of failure that can sever access for all users when ISP lines fail or become over saturated. Another challenge for sites using Citrix MetaFrame’s Web interface is overcoming the inability to direct end user requests across an array of available Web interface servers. The workload is not evenly distributed among the resources, it does not provide high availability, and there is no way to enhance the quality of service. Allowing the increasing number of remote users access to internal resources introduces a host of new challenges. Legacy solutions such as IPSec VPNs are costly and extremely difficult to maintain. Most internal resources are often highly sensitive and confidential, so providing security is a critical component. There are requirements for allowing access to any user regardless of location, platform or operating system.
Solution
Deploying the BIG-IP product with the Presentation Server web interface produces numerous improvements to scalability not possible with Presentation Server alone. The BIG-IP product provides high availability and scalability for a Citrix web interface deployment, and adds security with its SSL acceleration (encryption/decryption) capabilities. This added security is ideal for organizations using Citrix products to give clients access to corporate applications over the Internet. SSL acceleration reduces processor-intensive SSL transactions from the Web interface servers, which greatly improves the performance of the server, freeing it to fill more user requests. And using the BIG-IP product’s health checking capabilities to continuously monitor Citrix products ensures availability and performance as it routes incoming queries to the most available resource. With the Presentation Server and BIG-IP solution, enterprises experience easier deployment and reduced management overhead. For example, the BIG-IP product, while load balancing application traffic, can report traffic load statistics in real-time to an automated deployment system. When loads reach a specific threshold, an additional server is loaded with the Citrix application and immediately deployed by notifying the BIG-IP product that this additional Citrix resource is now available. The BIG-IP product can immediately begin directing traffic to the new resource, increasing application performance. With the BIG-IP software, scalability and high availability can be automated without requiring IT resources. The BIG-IP Link Controller helps enterprises achieve high availability and optimal performance for single site Citrix Presentation Server deployments. With the BIG-IP Link Controller and more than one public network connection, traffic is dynamically directed across other available links in the event of an ISP failure. In addition, the BIG-IP Link Controller can also help drive down bandwidth costs, by allowing organizations to depend on a less expensive Internet connection to serve this mission-critical application. The BIG-IP Link Controller monitors the health and availability of each ISP, detecting errors across an entire link to provide end-to-end, reliable WAN connectivity. It balances traffic to maximize link utilization and throughput, and can also direct traffic over the least expensive links for lowest cost bandwidth usage. For organizations with a wide range of remote access requirements including Citrix Presentation Server, the F5 FirePass controller SSL VPN solution provides tremendous flexibility. The FirePass SSL VPN enables companies to provide secure remote access to corporate resources to anyone connected to the Internet. Specific to Citrix Presentation Server deployments, the FirePass Terminal Server adapter automatically downloads and seamlessly installs the terminal server client component. The FirePass controller also supports group access options, user authentication and automatic logon capabilities for authorized users of Citrix Presentation Server.
1
F 5 APPLICATION READY NETWORK GUIDE
CITRIX PRESENTATION SERVER
Solution - Continued
With F5’s FirePass controller, organizations are able to extend access to Citrix MetaFrame resources to their remote workforce, partners, or customers. The FirePass SSL VPN provides secured, clientless access to off-sight users as easily as if they were in the in the corporate LAN. Once authenticated by the FirePass controller, users pass through the corporate firewall and are able to access MetaFrame resources without having to reauthenticate for multiple resources. The necessary Citrix MetaFrame client remote software is integrated into the FirePass device and is downloaded on demand, eliminating the need for any pre-installed Terminal Services software on the client device. This allows a wide variety of users to gain remote access to applications running on Citrix MetaFrame, while lowering the management cost and complexity.
Benefits
High Availability - The BIG-IP product detects a variety of device failures to ensure that mission-critical resources are responding properly, through the use of advanced health checking capabilities. The BIG-IP solution offers advanced content and application checks such as Extended Content Verification (ECV) and Extended Application Verification (EAV) that simulate an end user request and monitor the true availability of content. With the BIG-IP product, all of your applications can achieve mission-critical availability (99.999% uptime), while reducing operational complexity and costs. Easy Integration and Lower TCO - The FirePass controller can be deployed without modifying the existing network configuration. By eliminating the need to change existing authentication deployment, the FirePass solution reduces total cost of ownership. Increased Security - With the FirePass controller, organizations not only benefit from an extremely secure device, but the added protection of granular, sophisticated pre-login checks, denying access to users who do not have adequate anti-virus protection, or up-to-date operating system patch levels. Also enhancing the security of the solution is the use of a one-time password that protects against password theft. The BIG-IP product comes standard with numerous security features that provide an extremely scalable, highly available, and secure solution for both internal and external applications. The BIG-IP product can be used to balance both inbound and outbound traffic for devices like firewalls, caches, or routers. It enables stringent access control, secure administration, and helps resist common attacks. Extensible integration - iControl is the industry’s first open application program interface (API) for a comprehensive suite of application traffic management products. Made available as a free SDK, the iControl architectural approach overcomes the greatest challenges of integration; making it quick and easy to create intercommunication between 3rd party applications and the network via F5’s products. Increased ROI - This solution maximizes application availability, allows for trouble-free maintenance and reduces administration overhead. By offloading SSL and persistence functions (processor and server intensive operations) customers do not have to buy expensive hardware to support their applications. The result is up to 30% savings on hardware costs, with increased application performance. Scalability - The BIG-IP product provides a highly scalable solution that allows enterprises to meet growing organizational demands on Web and application resources. If one service is nearing capacity, scaling it is as simple as adding another instance of the service to your network and then to the BIG-IP load balancing pool.
About F5
F5 Networks is the global leader in Application Delivery Networking. F5 provides solutions that make applications secure, fast and available for everyone, helping organizations get the most out of their investment. By adding intelligence and manageability into the network to offload applications, F5 optimizes applications and allows them to work faster and consume fewer resources. F5’s extensible architecture intelligently integrates application optimization, protects the application and the network, and delivers application reliability—all on one universal platform. Over 10,000 organizations and service providers worldwide trust F5 to keep their applications running. The company is headquartered in Seattle, Washington with offices worldwide. For more information, go to www.f5.com.
About Citrix
Citrix Systems, Inc. is a global leader in virtual workplace software and services that provide access to applications, information, processes and people on any device, over any network, anywhere, anytime. Citrix makes today’s digital office completely virtual - instead of having to go to your office, the office follows you. Working with the world’s top industry, integration and consulting partners, Citrix delivers enterprise-ready solutions to business challenges including application deployment, remote office connectivity, workforce mobility and business continuity. More than 120,000 companies worldwide use Citrix Solutions for the Virtual Workplace to give users more mobility, give IT organizations more flexibility and reduce the cost of computing.
2